Wallhaven Downloader

Download wallpapers in batch from wallhaven.cc via API v1 with flexible query parameters (q, categories, purity, sorting, order, topRange, atleast, resolutio...

This skill appears to do exactly what it claims. Before installing, confirm you trust the publisher and accept that the script will: (1) make network requests to wallhaven.cc and w.wallhaven.cc, (2) spawn curl processes, and (3) write image files and manifest.json to the output directory you provide. Do not pass secrets other than your Wallhaven API key, and avoid using a key if you do not want to retrieve NSFW/private content. Because the script runs locally and is included in the package, you can inspect the provided scripts (they are included) before running. If you want extra assurance, run the script in an isolated environment or review the subprocess usage (it calls curl via a safe list-style invocation, not shell execution).

Type: OpenClaw Skill Name: wallhaven-downloader Version: 0.1.3 The skill is designed to download wallpapers from Wallhaven.cc and demonstrates strong security awareness. The `scripts/wallhaven_download.py` file includes robust validation functions (`validate_base_url`, `validate_image_url`, `_is_private_or_local_host`) to prevent Server-Side Request Forgery (SSRF) by strictly enforcing HTTPS and restricting all network requests to `wallhaven.cc` or `w.wallhaven.cc` hosts, explicitly rejecting private/local IP addresses. It uses `subprocess.run` with a list of arguments for `curl`, mitigating shell injection risks. There is no evidence of data exfiltration, persistence, or malicious prompt injection in `SKILL.md`.